CVE-2023-0400: Trellix DLP Auth Bypass Vulnerability

CVE-2023-0400 Overview

CVE-2023-0400 is a protection bypass vulnerability in Trellix Data Loss Prevention (DLP) for Windows version 11.9.x. A local authenticated user can bypass DLP controls when uploading sensitive data from a mapped network drive into a web-based email client. The same content loaded from a local drive was correctly blocked, indicating the inspection logic failed to apply to file paths originating from mapped drives. Versions prior to 11.9 detected and blocked the upload attempt. Trellix addressed the issue in DLP version 11.10.0. The weakness maps to [CWE-670] (Always-Incorrect Control Flow Implementation) and [CWE-427] (Uncontrolled Search Path Element).

Critical Impact
Authenticated insiders can exfiltrate regulated or confidential data through web email clients by staging files on mapped drives, defeating the DLP control that organizations rely on to prevent data loss.

Affected Products

Trellix Data Loss Prevention for Windows 11.9.x
Microsoft Windows endpoints running the vulnerable DLP agent
Environments using mapped network drives with DLP file-upload inspection

Discovery Timeline

2023-02-02 - CVE-2023-0400 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-0400

Vulnerability Analysis

The Trellix DLP agent inspects file content during upload events in browsers and web email clients to prevent sensitive data exfiltration. In version 11.9.x, the inspection path that handles upload sources fails to evaluate files served from mapped network drives. As a result, an authenticated local user can attach a sensitive file to a webmail message from a mapped drive letter and complete the upload without the DLP policy enforcing redaction, blocking, or alerting. The same operation against a local drive is intercepted and blocked, confirming the inspection logic exists but is not applied uniformly across file source types. This produces a confidentiality, integrity, and availability impact on protected data, since the control that gates outbound transfer is silently skipped.

Root Cause

The root cause is an inconsistent control flow [CWE-670] within the DLP content-inspection routine. The routine correctly resolves and evaluates files referenced through local paths but does not apply the same inspection to files referenced through Universal Naming Convention (UNC) paths exposed as mapped drives. The secondary classification [CWE-427] indicates the agent does not normalize or resolve the file source consistently before policy evaluation.

Attack Vector

Exploitation requires local access, low privileges, and user interaction. An authenticated user opens a web email client, attaches a sensitive document staged on a mapped drive, and submits the message. The DLP agent permits the upload because the mapped drive source is not inspected. No exploit code is required, and no Proof-of-Concept (PoC) is publicly listed. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog and has no observed in-the-wild exploitation.

No verified exploit code is available for this issue. Refer to the Trellix Security Advisory SB10394 for vendor-supplied technical details.

Detection Methods for CVE-2023-0400

Indicators of Compromise

Web email uploads of files sourced from mapped drive letters (for example Z:\, Y:\) on hosts running DLP 11.9.x.
DLP event logs showing inspection on local-drive uploads but no corresponding events for mapped-drive uploads in the same session.
Browser process activity opening files via UNC paths immediately before HTTP POST requests to webmail domains.

Detection Strategies

Inventory endpoints to identify DLP agent versions still at 11.9.x and flag them as detection-impaired.
Correlate file-server access logs for sensitive shares against outbound webmail traffic from the same user within a short time window.
Add SIEM rules that alert when browser processes read files over SMB and subsequently upload to external mail domains without a matching DLP inspection event.

Monitoring Recommendations

Monitor SMB read events on sensitive shares followed by browser file-attachment activity on the same endpoint.
Track DLP agent health and version state continuously to confirm policy coverage across all endpoints.
Audit webmail egress at the proxy or Cloud Access Security Broker (CASB) layer for attachments matching sensitive content classifiers.

How to Mitigate CVE-2023-0400

Immediate Actions Required

Upgrade Trellix Data Loss Prevention for Windows to version 11.10.0 or later on all affected endpoints.
Identify and prioritize endpoints running 11.9.x that have access to mapped drives containing regulated data.
Validate DLP policy enforcement post-upgrade by testing uploads from both local and mapped-drive sources to a controlled webmail target.

Patch Information

Trellix released the fix in DLP for Windows version 11.10.0. Patch details and download instructions are documented in the Trellix Security Advisory SB10394. Apply the update through standard Trellix ePolicy Orchestrator deployment workflows and confirm agent version reporting after rollout.

Workarounds

Restrict access to sensitive file shares so that users without an explicit business need cannot mount them as mapped drives.
Block or proxy-filter webmail attachment uploads at the network egress layer until the DLP agent is upgraded.
Disable mapped-drive auto-reconnection on at-risk endpoints to reduce the exposure window for staged exfiltration.

bash

# Verify the installed Trellix DLP agent version on a Windows endpoint
reg query "HKLM\SOFTWARE\McAfee\DLP\Agent" /v "ProductVersion"

# Expected output after remediation: ProductVersion REG_SZ 11.10.0 (or later)